The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is configured to execute yt-dlp and ffmpeg commands. The execution environment is restricted by the allowed-tools frontmatter, limiting shell access to these specific binaries.
[EXTERNAL_DOWNLOADS]: The primary purpose of the skill is to download media files from external URLs provided by the user. It supports a wide range of platforms including YouTube, Bilibili, and TikTok.
[REMOTE_CODE_EXECUTION]: The helper scripts located in the assets/ directory (e.g., check-ffmpeg.ps1, check-ffmpeg.sh) contain installation commands for package managers such as Scoop and Chocolatey. These commands involve downloading and executing remote installation scripts. However, the skill instructions in SKILL.md explicitly direct the agent to show these commands to the user and wait for confirmation, rather than executing them automatically.
[DATA_EXFILTRATION]: While the skill references the use of cookies.txt for accessing restricted content on sites like Bilibili, it does so in the context of standard yt-dlp functionality. There are no patterns indicating that the skill attempts to exfiltrate these cookies or other sensitive local data to unauthorized remote servers.
[DYNAMIC_EXECUTION]: The Python script assets/check-ffmpeg.py uses subprocess.run() to verify the FFmpeg version. This is a benign use of subprocess execution as the command is hardcoded and does not incorporate unsanitized user input.

yt-dlp